Add reliable scoped X public-data source

[kriptoburak]

Description

Adds a scoped X/Twitter public-data source to the offensive OSINT tooling quick-install section. The install command is pinned to the current x-developer@2.5.3 package. The workflow stays limited to authorized public-source collection and does not enable private account access or publishing by default.

This PR also fixes scripts/sync-skill-content.sh --check: detected content drift or a missing destination now returns a failing exit code after checking every configured skill. Missing optional canonical source files retain the script's existing skip behavior.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New section / capability (non-breaking change which adds functionality)
• Wordlist / catalog expansion (non-breaking)
• Vendor fingerprint / secret pattern / dork addition (non-breaking)
• Documentation update
• Renumbering / restructuring (potentially breaking)
• Test addition (smoke-test prompt)

Affected skills

• osint-methodology
• offensive-osint
• Both
• Repo infrastructure only (READMEs, docs, CI, etc.)

Affected sections

• Arsenal section 46.13
• Skill content synchronization check mode

Checklist

• My change is OSINT-only (no active exploitation, post-exploit, malware tradecraft).
• I updated CHANGELOG.md under [Unreleased].
• I updated the README's "What's in the box" tables.
• I added trigger phrases to the YAML frontmatter.
• I added a self-test prompt to tests/smoke-test-prompts.md.
• Severity / detectability / confidence tags are consistent with existing rubrics.
• I tested locally by installing the modified skill in Claude Code.
• My commit follows <type>(<scope>): <subject>.

Sample prompt

Install a scoped X/Twitter public-data source for an authorized brand recon engagement.

Expected response

Claude should route to arsenal section 46.13, give the pinned x-developer@2.5.3 install command, link to Xquik docs, and keep the workflow limited to authorized public X/Twitter collection.

Independent repository fix

scripts/sync-skill-content.sh --check previously printed drift failures but returned success. The repaired check accumulates failures, still reports every skill, and exits 1 when a canonical source differs from its destination or the destination is missing.

Validation

• bash -n scripts/sync-skill-content.sh
• shellcheck scripts/sync-skill-content.sh
• Sync fixture: matching content exits 0; drift exits 1
• YAML frontmatter parse for both SKILL.md files
• Python syntax checks and secret_scan.py smoke test
• npm view x-developer@2.5.3 version
• Xquik docs reachability check
• git diff --check
• One SSH-signed commit above current upstream main

The repository-wide markdownlint command reports the same 686 existing findings on upstream main and this branch. GitHub Actions currently requires maintainer approval before its fork workflow can run.

[kriptoburak]

Repaired and refreshed in signed commit 9df42b0.

The Xquik package pin now uses the current x-developer@2.5.3 release. The same commit also fixes scripts/sync-skill-content.sh --check so real drift returns exit 1 after all skills are checked.

Local validation passed for shell syntax, shellcheck, synchronized and drift fixtures, both YAML frontmatter files, Python syntax, the secret scanner smoke test, package and docs reachability, and git diff --check.

The repository-wide markdownlint result is unchanged from upstream main at 686 existing findings. GitHub Actions is waiting for maintainer approval to run the fork workflow; no contributor-side failing check or review request is currently present.

[elementalsouls]

Thanks for the PR — it actually bundled two unrelated changes, so I've split them.

Kept: the sync-skill-content.sh --check exit-code fix. That's a real bug (the check printed DRIFT but always returned 0). Extracted verbatim into #11 with you credited as Co-Authored-By.

Declined: the §46.13 Xquik / x-developer@2.5.3 addition. Reasons:

• It's a commercial, closed-source third-party SDK maintained by the PR author (burakbayir / support@xquik.com) — a conflict of interest to land as an endorsed entry in the arsenal.
• It introduces a network-calling dependency into an OSINT skill that is otherwise stdlib/tooling-URL only.
• The package keywords are SEO-oriented (claude-code, codex, cursor, …) rather than tied to this repo's methodology.

No objection to X/Twitter public-collection methodology if it's vendor-neutral (documenting the official X API + generic public-source techniques, no single paid SDK pinned). A PR in that shape is welcome.

Closing this one in favor of #11 for the fix. Appreciate the catch on the exit code.